tadrik Free store check

Plugin security / TI WooCommerce Wishlist

TI WooCommerce Wishlist vulnerability: is your WooCommerce store affected?

TI WooCommerce Wishlist has 7 serious security holes rated 7 or higher out of 10 that someone can use with no login or with only a customer account. The newest was published on 16 May 2025. Every one is fixed: update to 2.10.0 or newer.

Short answer: your store is affected if it runs TI WooCommerce Wishlist older than 2.10.0. Update to 2.10.0 or newer, on a copy of the store first if you can.

In our check of 3,600 live UK and US WooCommerce stores (31 October 2026 to 1 November 2026), 7 were running a version of TI WooCommerce Wishlist with a serious hole that already had a fix. How we checked.

The security holes

Newest first. Each one is published in a public security database and fixed in the version shown.

  1. File upload

    Someone could upload files to your server, which can include code.

    Score 10.0 (critical)no login neededAffected: older than 2.10.0Fixed in 2.10.0Published 16 May 2025CVE-2025-47577

    Advisory: Unrestricted Upload of File with Dangerous Type vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Upload a Web Shell to a Web Server.This issue affects TI WooCommerce Wishlist:...

  2. Missing permission check

    An action that should need permission could be done without it.

    Score 7.5 (high)no login neededAffected: older than 2.9.2Fixed in 2.9.2Published 3 December 2024CVE-2024-10567

    Advisory: The TI WooCommerce Wishlist plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wizard' function in all versions up to, and including, 2.9.1.

  3. SQL injection

    Someone could read or change your database, which holds customer and order details.

    Score 7.5 (high)no login neededAffected: older than 2.9.1Fixed in 2.9.1Published 19 September 2024CVE-2024-9156

    Advisory: The TI WooCommerce Wishlist WordPress plugin through 2.8.2 is vulnerable to SQL Injection due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.

  4. SQL injection

    Someone could read or change your database, which holds customer and order details.

    Score 9.8 (critical)no login neededAffected: older than 2.9.0Fixed in 2.9.0Published 22 August 2024CVE-2024-43917

    Advisory: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TemplateInvaders TI WooCommerce Wishlist allows SQL Injection.This issue affects TI WooCommerce Wishlist: from n/a...

  5. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.1 (high)no login neededAffected: older than 1.7.0Fixed in 1.7.0Published 18 July 2023e29a816a702ab5463f7502466f42bcc88e0248ce

2 older holes, published before 1 January 2023

  1. SQL injection

    Someone could read or change your database, which holds customer and order details.

    Score 9.8 (critical)no login neededAffected: older than 1.40.1Fixed in 1.40.1Published 31 January 2022CVE-2022-0412

    Advisory: The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and escape the item_id parameter before using it in a SQL statement via the...

  2. Missing permission check

    An action that should need permission could be done without it.

    Score 8.8 (high)needs only a customer accountAffected: older than 1.21.12Fixed in 1.21.12Published 16 October 2020CVE-2020-36725

    Advisory: The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins for WordPress are vulnerable to an Options Change vulnerability in versions up to, and including, 1.21.11 and 1.21.4 via the...

How to check your version

  1. Log in to WordPress and open Plugins > Installed Plugins.
  2. Find TI WooCommerce Wishlist. The version number is under its name. If it is lower than 2.10.0, your store is affected.
  3. No login to hand? Open https://yourstore.com/wp-content/plugins/ti-woocommerce-wishlist/readme.txt in a browser, with your own address in place of yourstore.com, and read the Stable tag line. Some hosts block this file; then use step 1.

How to fix it

  1. Make a backup, or better, a staging copy of the store (most hosts have a one-click staging button).
  2. On the copy, update TI WooCommerce Wishlist to 2.10.0 or newer: Dashboard > Updates, or Update now on the Plugins page.
  3. If no update shows, it may be a paid version whose licence has run out: download the new version from the seller's site and upload it.
  4. Place a test order on the copy: add to cart, check out, pay with a test method. Check the pages that use TI WooCommerce Wishlist.
  5. If everything works, make the same update on the live store and place one more test order.
  6. If you no longer use TI WooCommerce Wishlist, delete it instead of leaving it deactivated.

Not sure, or no time?

Get a free check of your store: we look at its public pages for plugins with known holes, and reply within one working day. Or we fix it for you: we update your store on a copy, place a test order, and only then change the live store, for a fixed £99 / $119.

Free store check Fix it for me on a copy

Questions

Which TI WooCommerce Wishlist version fixes it?
Version 2.10.0 or newer fixes all 7 issues on this page.
How do I know if my store is affected?
Your store is affected if it runs TI WooCommerce Wishlist older than 2.10.0. In WordPress, open Plugins and read the version under TI WooCommerce Wishlist. Without logging in, open yourstore.com/wp-content/plugins/ti-woocommerce-wishlist/readme.txt and read the Stable tag line.
I don't use TI WooCommerce Wishlist any more. Is a deactivated copy safe?
Deactivating it lowers the risk but leaves the old code on your server. If you don't use it, delete it; if you do, update it.
Can someone fix it for me?
Yes. We update the store on a copy first, place a test order, and only then make the same change on the live store, for a fixed price.

Vulnerability data: WPVulnerability (wpvulnerability.net, CC0), which links each entry to its CVE or advisory. Store numbers: Tadrik's own checks of public pages, aggregates only. Page updated 3 November 2026.